krb5: CVE-2020-28196

Debian Bug report logs - #973880
krb5: CVE-2020-28196

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: krb5: CVE-2020-28196

Date: Fri, 06 Nov 2020 14:05:56 +0100

Source: krb5
Version: 1.17-10
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 1.17-3

Hi,

The following vulnerability was published for krb5.

CVE-2020-28196[0]:
| MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3
| allows unbounded recursion via an ASN.1-encoded Kerberos message
| because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite
| lengths lacks a recursion limit.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-28196
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28196
[1] https://github.com/krb5/krb5/commit/57415dda6cf04e73ffc3723be518eddfae599bfd

Regards,
Salvatore

Message #12 received at 973880@bugs.debian.org (full text, mbox, reply):

From: Sam Hartman <hartmans@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: 973880@bugs.debian.org

Subject: Re: Bug#973880: krb5: CVE-2020-28196

Date: Fri, 06 Nov 2020 17:04:56 -0500

Thanks for the note.  I've been meaning to do a much needed krb5 update
and this definitely pushes it up the priority stack.
I'll work on this over the weekend.

Message #19 received at 973880-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 973880-close@bugs.debian.org

Subject: Bug#973880: fixed in krb5 1.18.2-1

Date: Tue, 10 Nov 2020 23:00:11 +0000

Source: krb5
Source-Version: 1.18.2-1
Done: Sam Hartman <hartmans@debian.org>

We believe that the bug you reported is fixed in the latest version of
krb5, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 973880@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sam Hartman <hartmans@debian.org> (supplier of updated krb5 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Mon, 09 Nov 2020 16:28:52 -0500
Source: krb5
Binary: krb5-admin-server krb5-admin-server-dbgsym krb5-doc krb5-gss-samples krb5-gss-samples-dbgsym krb5-k5tls krb5-k5tls-dbgsym krb5-kdc krb5-kdc-dbgsym krb5-kdc-ldap krb5-kdc-ldap-dbgsym krb5-kpropd krb5-kpropd-dbgsym krb5-locales krb5-multidev krb5-otp krb5-otp-dbgsym krb5-pkinit krb5-pkinit-dbgsym krb5-user krb5-user-dbgsym libgssapi-krb5-2 libgssrpc4 libk5crypto3 libkadm5clnt-mit12 libkadm5srv-mit12 libkdb5-10 libkrad-dev libkrad0 libkrb5-3 libkrb5-dbg libkrb5-dev libkrb5support0
Architecture: source amd64 all
Version: 1.18.2-1
Distribution: experimental
Urgency: medium
Maintainer: Sam Hartman <hartmans@debian.org>
Changed-By: Sam Hartman <hartmans@debian.org>
Description:
 krb5-admin-server - MIT Kerberos master server (kadmind)
 krb5-doc   - documentation for MIT Kerberos
 krb5-gss-samples - MIT Kerberos GSS Sample applications
 krb5-k5tls - TLS plugin for MIT Kerberos
 krb5-kdc   - MIT Kerberos key server (KDC)
 krb5-kdc-ldap - MIT Kerberos key server (KDC) LDAP plugin
 krb5-kpropd - MIT Kerberos key server (Slave KDC Support)
 krb5-locales - internationalization support for MIT Kerberos
 krb5-multidev - development files for MIT Kerberos without Heimdal conflict
 krb5-otp   - OTP plugin for MIT Kerberos
 krb5-pkinit - PKINIT plugin for MIT Kerberos
 krb5-user  - basic programs to authenticate using MIT Kerberos
 libgssapi-krb5-2 - MIT Kerberos runtime libraries - krb5 GSS-API Mechanism
 libgssrpc4 - MIT Kerberos runtime libraries - GSS enabled ONCRPC
 libk5crypto3 - MIT Kerberos runtime libraries - Crypto Library
 libkadm5clnt-mit12 - MIT Kerberos runtime libraries - Administration Clients
 libkadm5srv-mit12 - MIT Kerberos runtime libraries - KDC and Admin Server
 libkdb5-10 - MIT Kerberos runtime libraries - Kerberos database
 libkrad-dev - MIT Kerberos RADIUS Library Development
 libkrad0   - MIT Kerberos runtime libraries - RADIUS library
 libkrb5-3  - MIT Kerberos runtime libraries
 libkrb5-dbg - debugging files for MIT Kerberos
 libkrb5-dev - headers and development libraries for MIT Kerberos
 libkrb5support0 - MIT Kerberos runtime libraries - Support library
Closes: 973880
Changes:
 krb5 (1.18.2-1) experimental; urgency=medium
 .
   * New Upstream version
   * Include several pre-release patches from 1.18.3:
     - Unregister thread key in SPNEGO finalization
     - Set pw_expiration during LDAP load
   -  Avoid using LMDB environments across forks
     - Allow gss_unwrap_iov() of unpadded RC4 tokens
     - Fix input length checking in SPNEGO DER decoding
     - Set lockdown attribute when creating LDAP KDB
     - Add recursion limit for ASN.1 indefinite lengths (CVE-2020-28196,
     Closes: #973880)
   * Release new upstream to experimental
Checksums-Sha1:
 0ed300ac51eec42de7d43ca97d9d334b1f70d8f7 3199 krb5_1.18.2-1.dsc
 547c4e4afa06dd39c888a9ee89397ec3c3425c90 8713927 krb5_1.18.2.orig.tar.gz
 73759ea6d22cb8f6e04473f08da061ec76648943 110180 krb5_1.18.2-1.debian.tar.xz
 dc6cfc05f8d12f5b5839b28b6960088fb4933a13 201740 krb5-admin-server-dbgsym_1.18.2-1_amd64.deb
 3124239226380cdcbca481e9aded4c13ed438d67 124780 krb5-admin-server_1.18.2-1_amd64.deb
 e0679cdf53e5c10c4dd172897256e1e862242ecf 2369596 krb5-doc_1.18.2-1_all.deb
 d63096570bc2ba6c74767e997359d58a68b9bea9 36940 krb5-gss-samples-dbgsym_1.18.2-1_amd64.deb
 a90cf9e776ede7656c210dbf41afa07a6ad27965 60436 krb5-gss-samples_1.18.2-1_amd64.deb
 4aaa1cb5b50bd1cf868bb12ae776baab91d4c48b 19952 krb5-k5tls-dbgsym_1.18.2-1_amd64.deb
 9438e83ce7d28161f713098a536e026af95cbff1 51104 krb5-k5tls_1.18.2-1_amd64.deb
 f68808f9dd9d2accf405768a83dd20a715b7e317 435820 krb5-kdc-dbgsym_1.18.2-1_amd64.deb
 f844e9216bdb7d99a72de1424769e8670ccab7ba 187180 krb5-kdc-ldap-dbgsym_1.18.2-1_amd64.deb
 2321aa9f08004625e7419c427021c0773d03ef36 120296 krb5-kdc-ldap_1.18.2-1_amd64.deb
 336fd2781eef6d62e7e02b23b52f68b5f7458606 210896 krb5-kdc_1.18.2-1_amd64.deb
 ce711206c0dc6367edd09f254b0bd8f1501df386 42116 krb5-kpropd-dbgsym_1.18.2-1_amd64.deb
 f02e1fd1952d2918dd3304d4630bd3a6dfb7992d 63132 krb5-kpropd_1.18.2-1_amd64.deb
 953eaacfd8d6e5229e68d4b08cdf0590f28dba84 94788 krb5-locales_1.18.2-1_all.deb
 3b7307ceccc42abba0aaeb419e418a60036b7a7f 156988 krb5-multidev_1.18.2-1_amd64.deb
 4350357b0d650ef91f6ad7dd9732befa526e4013 29368 krb5-otp-dbgsym_1.18.2-1_amd64.deb
 d2c2b28fefdcda2df27fe9cc4bd367c4abaf9fb2 53520 krb5-otp_1.18.2-1_amd64.deb
 2dc3d8af28bb0aaa7486e2f8298a8ee05113a9d9 154728 krb5-pkinit-dbgsym_1.18.2-1_amd64.deb
 a036731a55440fab5f0a30f1df959329855e0594 88300 krb5-pkinit_1.18.2-1_amd64.deb
 3a3a7cfec3fc7d1297da361a4283bdb11b3837d6 194468 krb5-user-dbgsym_1.18.2-1_amd64.deb
 f6793115cbb433d85ba3945828dc2061644f3036 150308 krb5-user_1.18.2-1_amd64.deb
 007ce29629dddb2fd2fef95f0fcff4f02d85a151 20000 krb5_1.18.2-1_amd64.buildinfo
 d68a9a27f1b62736ce83a259ed44fc32ecf1ea20 164540 libgssapi-krb5-2_1.18.2-1_amd64.deb
 19d5b850ca41fd8fdd15be924c34dd6fdf16e4f2 90932 libgssrpc4_1.18.2-1_amd64.deb
 c237351275c7b206ec64dd7ebed1e3a5e205a932 113412 libk5crypto3_1.18.2-1_amd64.deb
 af3d7eaeadf4e1ecfd50cae7165acf0d89e040c6 73200 libkadm5clnt-mit12_1.18.2-1_amd64.deb
 154f97881c0cd1629c99fdb47acd25b2815614ed 85072 libkadm5srv-mit12_1.18.2-1_amd64.deb
 3a9201ea25c615eecd045638339ef022800b1e13 72760 libkdb5-10_1.18.2-1_amd64.deb
 f17eb3ee7b1cc63049b67f62ec2a68150a81a38a 47356 libkrad-dev_1.18.2-1_amd64.deb
 d65c3f4fccdb923e4c8c3295e1b4597ae4d4ab72 56660 libkrad0_1.18.2-1_amd64.deb
 b7e1cb7c8be096c9895f4b867d115d139f5be864 362148 libkrb5-3_1.18.2-1_amd64.deb
 20df708d1515b4480fb125a55189a7eaa362ea57 2206844 libkrb5-dbg_1.18.2-1_amd64.deb
 9cc7ef589029992c1d873c324b1a4811e8ca8c97 46876 libkrb5-dev_1.18.2-1_amd64.deb
 14d187be3a1abbecb798b4249593050e2cf884a2 64868 libkrb5support0_1.18.2-1_amd64.deb
Checksums-Sha256:
 172ab785fe4315b52b40880aa139aad4242491164dfa8d62e6e946e1965c201c 3199 krb5_1.18.2-1.dsc
 c6e4c9ec1a98141c3f5d66ddf1a135549050c9fab4e9a4620ee9b22085873ae0 8713927 krb5_1.18.2.orig.tar.gz
 878a4395916e8c69845fd7d68b0c82bf7f91c7afaeab37acaf7b4284f9ed2402 110180 krb5_1.18.2-1.debian.tar.xz
 51e5573b59ba5aac6f873da3ac6fe7a62a2491bc89fe89afaf864203b110c025 201740 krb5-admin-server-dbgsym_1.18.2-1_amd64.deb
 af877ae69fa51ca9e4ac031895cb537506a28b015d519de69f1df3d6201d0248 124780 krb5-admin-server_1.18.2-1_amd64.deb
 8479ddd03a1ceb21272229ae1bad7788bcaf58fc34327497381fa13795dd66ab 2369596 krb5-doc_1.18.2-1_all.deb
 3bd05b249502478d81ec1e5965f845c3f7802f329928e77de4bf6a9e5063fe2e 36940 krb5-gss-samples-dbgsym_1.18.2-1_amd64.deb
 a6069531d24f396496f4edaa23f9743916e2b66f73700fa80a2a9e0d79a60b14 60436 krb5-gss-samples_1.18.2-1_amd64.deb
 40502fc6b3d6f25a88ad61e1a7a188acf032dbf4e99619f684d360eea1a1eec8 19952 krb5-k5tls-dbgsym_1.18.2-1_amd64.deb
 e6dda3f28ae30863035c7f933016ecdfa12d4aabf5aa4746bf907151a652f807 51104 krb5-k5tls_1.18.2-1_amd64.deb
 e5d4a9acd56228adf5210a26d336edb403e0d464cb611dc69c6cd31330071091 435820 krb5-kdc-dbgsym_1.18.2-1_amd64.deb
 22d7ec0c2fc52a1a6f4c7656969683fe3abee97683d021f9d2c94fcb4200487d 187180 krb5-kdc-ldap-dbgsym_1.18.2-1_amd64.deb
 4f9db185ac52e3ac52b3b761979f33e353abd26bb3c33f6e2367bb159722d6d6 120296 krb5-kdc-ldap_1.18.2-1_amd64.deb
 4aa74f3e477222586f8b915c1e346ce205777ca5017b113fda27c499cceb027f 210896 krb5-kdc_1.18.2-1_amd64.deb
 8ad9345b0a734dc0a60efe557f196b82fe4ccc48a7d8e50b26f04cbf37ac650c 42116 krb5-kpropd-dbgsym_1.18.2-1_amd64.deb
 b13ade0ef31d651ef966fc4f188b88a37994c696fa104e28e36cad0c39798817 63132 krb5-kpropd_1.18.2-1_amd64.deb
 2ca494b2a03fffb751e8eed236ceda460ae59dfc05edd5d40e9eb4cd8c8a1ff3 94788 krb5-locales_1.18.2-1_all.deb
 273d98489877721bc2695ce6ace381950ef12512caf7ea6d64ae952b5b86c581 156988 krb5-multidev_1.18.2-1_amd64.deb
 624015bc9b823003b58567d5bea2e929b40e87984fc14ee7c3d496f1a8309099 29368 krb5-otp-dbgsym_1.18.2-1_amd64.deb
 bf35789a26ca4b03f584b8329ccc9b134f767008d5010829bd6356e43e9f1757 53520 krb5-otp_1.18.2-1_amd64.deb
 2b919e529b1da648cb93429ed0e29fe8cbcfcfbbd361d6104438051f7820b2af 154728 krb5-pkinit-dbgsym_1.18.2-1_amd64.deb
 a65f57fa489f10db7e048ac6d6b6fdc394fac883aebbc3b730d581b56d3df46a 88300 krb5-pkinit_1.18.2-1_amd64.deb
 36739bed43c4f1867ea946ccdc34f1a39810b8ac6bc98fb9b929e6934a164ea2 194468 krb5-user-dbgsym_1.18.2-1_amd64.deb
 182cf2e2653d184c63dd3f4d3c9c9299b014471616526c21dffc35779ec7d792 150308 krb5-user_1.18.2-1_amd64.deb
 c39138b2fe8a44c90bc5502d956c683dba1e3f43c595bd455913c8557d7b4b0f 20000 krb5_1.18.2-1_amd64.buildinfo
 e4c1654fcc9f5865a612da1397c27af86ee4d7f2166c94ec2f89b1e4afadcd21 164540 libgssapi-krb5-2_1.18.2-1_amd64.deb
 eec8d6585fc27cfe3504b8cc956bcf8562d252fe1873df1c3f547481fbc92504 90932 libgssrpc4_1.18.2-1_amd64.deb
 8572704ab09c7c134b0fe26597103b37ab3186c5f3b23c061bac36135df781c4 113412 libk5crypto3_1.18.2-1_amd64.deb
 1264b7f17d9cf48d68f4183b008a8acd2914688a92da28cb0a8e7b7d533283a1 73200 libkadm5clnt-mit12_1.18.2-1_amd64.deb
 19ff295b2529ac4189f5691bf54e65a58785b25eadb7ea54f1a0304a4fa531b3 85072 libkadm5srv-mit12_1.18.2-1_amd64.deb
 3bd9e987ebc20a52e179546ff79c52bb5bbe5ea47512746bc6781d213011d830 72760 libkdb5-10_1.18.2-1_amd64.deb
 f3a528953c4377ac4b9b97aa0780d013361a2bde74a8463075cf31bc57b2865a 47356 libkrad-dev_1.18.2-1_amd64.deb
 f8447ed45107f58eb5dd64a16d4f9ef6b4a21b1738686d392f42ca7e1b8431b8 56660 libkrad0_1.18.2-1_amd64.deb
 ae9c1619e53ae1aae5e85e1f6d741405b7df70faa6fbfbd08545e56d6ccf0861 362148 libkrb5-3_1.18.2-1_amd64.deb
 ba8db5b93a8d4bba5526de237b25a34076e0e3cc6d624f5b24965607524f494d 2206844 libkrb5-dbg_1.18.2-1_amd64.deb
 bd8be32c62cd9eaa11c7b79d11abd1f75b52f81955283a1bd340af80c2926211 46876 libkrb5-dev_1.18.2-1_amd64.deb
 d18ab808ae51ecbea9dbd46febf20868890b6ebca5d6833b05931aa6f465b8a8 64868 libkrb5support0_1.18.2-1_amd64.deb
Files:
 d189fc0382dfbf510594435ed4f00a6c 3199 net optional krb5_1.18.2-1.dsc
 fd9087eaa43589a2480c2e22da91a17e 8713927 net optional krb5_1.18.2.orig.tar.gz
 69be754d734f085bdc6eb358d24fc487 110180 net optional krb5_1.18.2-1.debian.tar.xz
 2891f6981c72f0481247812cded27728 201740 debug optional krb5-admin-server-dbgsym_1.18.2-1_amd64.deb
 52ebc7500020a902cb4599c201c5de22 124780 net optional krb5-admin-server_1.18.2-1_amd64.deb
 b97a02c26efafdf98252dcbe604ba984 2369596 doc optional krb5-doc_1.18.2-1_all.deb
 a6f75ad1659fbf9f1c12d0df2e0c9117 36940 debug optional krb5-gss-samples-dbgsym_1.18.2-1_amd64.deb
 e54721e4b3d78aba474766a0d84a0397 60436 net optional krb5-gss-samples_1.18.2-1_amd64.deb
 02c564462b61b3d6b66400f2c256c9b2 19952 debug optional krb5-k5tls-dbgsym_1.18.2-1_amd64.deb
 bef0db1fe781e4997b00840db905ca94 51104 net optional krb5-k5tls_1.18.2-1_amd64.deb
 b1d026b6690fe82268d90b6e99ea45c5 435820 debug optional krb5-kdc-dbgsym_1.18.2-1_amd64.deb
 e6512490d6237a6b4f907bb95093adbe 187180 debug optional krb5-kdc-ldap-dbgsym_1.18.2-1_amd64.deb
 45f76e840aab29ccf55ee5c26424ca38 120296 net optional krb5-kdc-ldap_1.18.2-1_amd64.deb
 9566c4e6e10e831015b45042497bc41e 210896 net optional krb5-kdc_1.18.2-1_amd64.deb
 25ffab12820b28fcbb16f53d05882d6c 42116 debug optional krb5-kpropd-dbgsym_1.18.2-1_amd64.deb
 02e0cd550669a1ea08dc50a55d9a7ae4 63132 net optional krb5-kpropd_1.18.2-1_amd64.deb
 5b62758993790e316451115a96452641 94788 localization optional krb5-locales_1.18.2-1_all.deb
 f8420b79aee4b6f4cc1ef73d2ec9d1ac 156988 libdevel optional krb5-multidev_1.18.2-1_amd64.deb
 75b92df8e422fe2a67ff6d709a285cd9 29368 debug optional krb5-otp-dbgsym_1.18.2-1_amd64.deb
 f0e0a9991c119664b77c1d48e47975d3 53520 net optional krb5-otp_1.18.2-1_amd64.deb
 faa6cf4cebddd6110c036431ba9a2426 154728 debug optional krb5-pkinit-dbgsym_1.18.2-1_amd64.deb
 11a82af1226b3bba571c453969d0e74c 88300 net optional krb5-pkinit_1.18.2-1_amd64.deb
 4f9cf1d0cf5b9f305cb4f3753beccb9f 194468 debug optional krb5-user-dbgsym_1.18.2-1_amd64.deb
 c113341a1f8bdbfbd0addac2c9a33ffb 150308 net optional krb5-user_1.18.2-1_amd64.deb
 4c57e4b09bc64f13a902eb4691f10ed8 20000 net optional krb5_1.18.2-1_amd64.buildinfo
 daf295a4fedbce53d00fdd858b07daa9 164540 libs optional libgssapi-krb5-2_1.18.2-1_amd64.deb
 3e6b108d2f3f56a21a597d35ea46546b 90932 libs optional libgssrpc4_1.18.2-1_amd64.deb
 5b0073dfc9af48276b60f47498c13f12 113412 libs optional libk5crypto3_1.18.2-1_amd64.deb
 ebbccfecd94bfa236193a2a75e35e880 73200 libs optional libkadm5clnt-mit12_1.18.2-1_amd64.deb
 8f3e261823d3871409a362f6abd5c5b3 85072 libs optional libkadm5srv-mit12_1.18.2-1_amd64.deb
 9b2e7f1cb7861dfd806c73830b2fcf53 72760 libs optional libkdb5-10_1.18.2-1_amd64.deb
 35912184006c50365ed25bedc22e5e0b 47356 libdevel optional libkrad-dev_1.18.2-1_amd64.deb
 fe71267842780cdf30bf459900925d26 56660 libs optional libkrad0_1.18.2-1_amd64.deb
 55245fd96cbb1090ed2635d33c371c56 362148 libs optional libkrb5-3_1.18.2-1_amd64.deb
 cbbe9ba7f12c84d073b2f31a13791ce5 2206844 debug optional libkrb5-dbg_1.18.2-1_amd64.deb
 60e50d44b57eb02a0191cbda5252a679 46876 libdevel optional libkrb5-dev_1.18.2-1_amd64.deb
 24b630545481144abb6e524ba084ae5c 64868 libs optional libkrb5support0_1.18.2-1_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEE9Li3nMNy++OFgPTCQe7SUh/WssoFAl+q66AACgkQQe7SUh/W
ssqfSggAj9ypXcGV9rIlbFblpaE4sd/apMoSiC7k96pO80ltGYNW6RWaqQxE1/k6
8m9Zd4Q9aZoMaPDqyTmE+YZLZb22J/eNuCgT2oN0ZBbwXKSpmDwwaMfy/jLlbMT6
K/qt5cLXiP+tcUEfwUuyhTTd3ffC6ogv+98stkRMzwZs/fQZaHUFmS6Vg0TZEiSY
DzyIo5VbrxuxHF+3oTrP6crsc4NcGIQIx3J3hFg4cx5hSJIrlavfmdrcG3EQm5oC
DZVSdoRwVbWnsSYLU/b8JmHrywrRKp1ppvI17/k9OjPT5OGwgU6Gh53ppOmC+tKp
8A2ebdI97xGeiuG7QhcMcF/2QRqYOA==
=cs+s
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.